The Agent Skills Directory

[SAFE]: The skill provides a set of Python scripts (setup_products.py, sync_subscriptions.py, webhook_handler.py, etc.) and extensive documentation for Stripe integrations. Analysis of all 11 threat categories revealed no malicious patterns.
[DATA_EXPOSURE]: The skill mentions various sensitive file paths (e.g., .env, ~/.ssh/) and environment variables (e.g., STRIPE_SECRET_KEY) in the context of educational guidance and local configuration auditing. No code was found that attempts to exfiltrate these credentials or files to an external destination.
[EXTERNAL_DOWNLOADS]: The skill references and provides commands to install official packages from well-known and trusted sources, including Stripe's official SDKs (Node.js and Python) and community-standard libraries like Flask and Firebase Admin. These are documented neutrally as required for standard integration workflows.
[INDIRECT_PROMPT_INJECTION]: The skill includes a webhook handler (scripts/webhook_handler.py) that processes incoming data from Stripe. While this represents a data ingestion surface, the implementation correctly utilizes stripe.webhooks.construct_event to verify cryptographic signatures, ensuring that the agent only processes authentic data from the trusted provider.

stripe